isitdns
Is it DNS? Audit a site or domain that isn't working: one call says if it resolves and why. No key.
Connect it
Settings → Connectors → Add custom connector
URL: https://isitdns.net/mcpSettings → Apps & Connectors → Advanced → Developer mode
Create connector with URL: https://isitdns.net/mcp{
"mcpServers": {
"isitdns": {
"url": "https://isitdns.net/mcp"
}
}
}claude mcp add --transport http isitdns https://isitdns.net/mcp{
"servers": {
"isitdns": {
"type": "http",
"url": "https://isitdns.net/mcp"
}
}
}6 tools, verified live
check_domainread-onlyCheck a domain that is not working: whether the name resolves in public DNS, then the eleven-check audit of its zone, each row ok, warn, fail or skipped with why. DNS only, not HTTP or TLS, and not for one record: dig. Measured from the isitdns edge and its probes, never the caller's network. from moves the recursion, TTL and UDP truncation rows to that region's probe.
digread-onlyDig one name and type at one board resolver, or at Cloudflare, Google, Quad9 and AdGuard side by side (resolver all): records, flags, rcode, EDE, latency. Not for a whole domain: check_domain. Asked over DoH from the isitdns edge. from moves the question to that region's probe as Do53 over UDP, and follow: true adds the CNAME chain as separate reads with DNSSEC off. A resolver given as an address
traceread-onlyTrace a delegation from the root to the authority, like dig +trace: each referral and its glue, the one server that answered at each zone cut and any dial that failed, the final answer and its TTLs. Not for every server of a zone: sweep_domain. Each hop is asked with RD=0 over TCP from the isitdns edge or a probe, named on the hop. Give the full host name: the walk ends at the zone that answers fo
dnssec_chainread-onlyWalk the DNSSEC chain from the root to one answer: DS and DNSKEY at each signed zone cut, key tags, signers, signature windows, and the first link that breaks or goes insecure. Not for one signed record: dig. Read through Cloudflare's resolver over DoH with CD=1 from the isitdns edge, and a key set a break would rest on again through Google's. Signature bytes are not verified, so a clean walk does
sweep_domainread-onlySweep a zone's nameservers: the same names and types asked at a sample of its authoritative addresses, reporting disagreements, lame or silent servers, serial and TTL differences, the CAA in effect, and each _acme-challenge TXT or CNAME. Not for a public resolver's answer: dig. Asked with RD=0 over TCP from the isitdns edge or a probe, named on each answer. Every question not asked is listed with
registrationread-onlyRead a domain's registration from its registry's RDAP server: each status with what it means for resolution, the registration, expiry and change dates, the nameservers, whether the delegation is signed. Not for what DNS answers: check_domain. Read over HTTPS from the isitdns edge through IANA's RDAP bootstrap, and no contacts are returned. A hostname is read at the name, then each parent down to t
Alternatives in Security
Compare →VCVITNA – Containment for rogue AI agentsB
Guard wraps stdio MCP servers: risky calls wait for a person; no answer, no run. Remote: cooperative
SXSputnik X — AI-Agent-Native IntelligenceB
Sputnik X: 16 free MCP tools and EU Trade via authenticated REST and x402.
MAC Address LookupB
Find the organization behind a MAC address or OUI prefix in the IEEE registries. No auth, no key.
VPVPSnetB
Manage VPSnet servers, apps, private networks and Functions with authorized customer access.
TSTehProf SupportB
Helpdesk tickets from your AI: find, reply, take, hold, complete — within your own role. OAuth.
Moltline Agent GovernanceB
Audit MCP configs and skill files for over-broad scope and injection risk. 6 of 8 free.